Sign in

API Documentation

Token-based JSON API to retrieve encrypted reports and integrate with your internal systems.

Authentication

Enable the API at the program level and use its token in requests.

Header Method (Recommended)

Authorization: Token <your_api_token>

Query String Method

?api_token=<your_api_token>

Enable API: Go to Admin → Companies → Programs → Enable "API enabled" and copy the generated token.

GET

List Reports

/reports/api/programs/<program_id>/reports/

Retrieve all reports for a specific program. Supports filtering by status and severity, with pagination.

Query Parameters

status Filter by status: new, triaged, resolved, invalid, duplicate, closed
severity Filter by severity: low, medium, high, critical
page Page number (default: 1)
page_size Results per page (default: 50, max: 100)

Example Request

curl -H 'Authorization: Token YOUR_TOKEN' \
  'https://responsibledisclosure.io/reports/api/programs/YOUR_PROGRAM_ID/reports/?severity=high&page=1'

Response

{
  "program": {
    "id": "uuid",
    "title": "Program Name",
    "company": "Company Name"
  },
  "count": 42,
  "num_pages": 3,
  "page": 1,
  "results": [
    {
      "id": "uuid",
      "program_id": "uuid",
      "status": "new",
      "severity": "high",
      "created_at": "2025-01-15T10:30:00Z",
      "updated_at": "2025-01-15T10:30:00Z",
      "acknowledged_at": null,
      "resolved_at": null,
      "encrypted_title": "base64_encrypted_data",
      "encrypted_description": "base64_encrypted_data",
      "reporter_email": "[email protected]",
      "reporter_name": "Security Researcher"
    }
  ]
}
GET

Get Single Report

/reports/api/programs/<program_id>/reports/<report_id>/

Retrieve detailed information about a specific report, including attachments and comments.

Example Request

curl -H 'Authorization: Token YOUR_TOKEN' \
  'https://responsibledisclosure.io/reports/api/programs/YOUR_PROGRAM_ID/reports/REPORT_ID/'

Response

Returns full report details including encrypted title, description, attachments, and comments.

GET

List Public Programs

/api/security-programs/

Retrieve list of public vulnerability disclosure programs. No authentication required.

Example Request

curl 'https://responsibledisclosure.io/api/security-programs/'

Error Responses

Standard JSON error responses with HTTP status codes.

401 Unauthorized

{ "error": "Invalid or missing API token" }

403 Forbidden

{ "error": "API not enabled for this program" }

404 Not Found

{ "error": "Report not found" }

Need Help?

For assistance with API integration or questions about response formats, contact us.

[email protected]